CVE-2021-26917

{"id": "CVE-2021-26917", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-02-08T23:15:11.973", "references": [{"url": "https://attack.mitre.org/techniques/T1113/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/Bitmessage/PyBitmessage/blob/f381721bec31641002e2f240309600c4994855a7/src/api.py#L35-L37", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/Bitmessage/PyBitmessage/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://poal.co/s/technology/290479", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://attack.mitre.org/techniques/T1113/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Bitmessage/PyBitmessage/blob/f381721bec31641002e2f240309600c4994855a7/src/api.py#L35-L37", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Bitmessage/PyBitmessage/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://poal.co/s/technology/290479", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value. NOTE: the discoverer states \"security mitigation may not be necessary as there is no evidence yet that these screen intercepts are actually transported away from the local host.\" NOTE: it is unclear whether there are any common use cases in which apinotifypath is controlled by an attacker"}, {"lang": "es", "value": "** EN DISPUTA ** PyBitmessage versiones hasta 6.3.2, permite a atacantes escribir capturas de pantalla en Directorios Potencialmente No Deseados por medio de un valor de apinotifypath dise\u00f1ado. NOTA: el descubridor afirma que \"Es posible que la mitigaci\u00f3n de la seguridad no sea necesaria ya que a\u00fan no existe evidencia de que estas interceptaciones de pantalla se transporten fuera del host local\". NOTA: no est\u00e1 claro si se presentan casos de uso comunes en los que apinotifypath est\u00e1 controlado por un atacante"}], "lastModified": "2024-11-21T05:57:02.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bitmessage:pybitmessage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F55615E-8714-458A-99A9-A4874AFD5AE1", "versionEndIncluding": "0.6.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}